Re: potential null deref in mpeg_open()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 7/19/09 7:47 AM, Dan Carpenter wrote:
Hello,

I am testing a source checker (http://repo.or.cz/w/smatch.git) and it
found a bug in in mpeg_open() from drivers/media/video/cx23885/cx23885-417.c

"dev" is null on line 1554, so on line 1558 dprintk() will cause a
kernel oops if it is in debug mode.

drivers/media/video/cx23885/cx23885-417.c
   1554          struct cx23885_dev *h, *dev = NULL;
   1555          struct list_head *list;
   1556          struct cx23885_fh *fh;
   1557
   1558          dprintk(2, "%s()\n", __func__);

Here is how dprintk() is defined earlier.

drivers/media/video/cx23885/cx23885-417.c
     59  #define dprintk(level, fmt, arg...)\
     60          do { if (v4l_debug>= level) \
     61                  printk(KERN_DEBUG "%s: " fmt, dev->name , ## arg);\
     62          } while (0)

regards,
dan carpenter

Thanks Dan,

I'd actually seen this three weeks ago when addressing another issue, although thanks for raising it. We're pushing a fix for this, and a few other fixes, later today.

--
Steven Toth - Kernel Labs
http://www.kernellabs.com
--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[Index of Archives]     [Linux Input]     [Video for Linux]     [Gstreamer Embedded]     [Mplayer Users]     [Linux USB Devel]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Yosemite Backpacking]
  Powered by Linux